Article 71 requires the Commission, in collaboration with the Member States, to set up and maintain an EU database containing information about high-risk AI systems referred to in Article 6(2) registered under Articles 49 and 60, and about systems not considered high-risk under Article 6(3) registered under Article 6(4) and Article 49. Providers or authorised representatives enter Annex VIII Sections A and B, and specified deployers enter Section C. Apart from the restricted sections, Article 49 information is publicly accessible in a user-friendly, navigable and machine-readable form, while Article 60 information is restricted to market surveillance authorities and the Commission unless the provider consents to public access.
Who sets up and maintains the database?
Article 71 places the database with the Commission, working in collaboration with the Member States. When setting the functional specifications of the database, the Commission must consult relevant experts, and when updating those specifications it must consult the Board, the European Artificial Intelligence Board. That consultation structure matters for planning because the database is not a static form: its fields, formats and access arrangements can be specified and updated through that process, and a team building an internal register to feed it should expect the specification to evolve. The Commission also acts in the data-controller role for the database, and the database must contain personal data only so far as necessary for collecting and processing information under the Regulation. Operational questions about the live database, including how to submit and correct an entry, should therefore be answered from current Commission material rather than from a summary written before the database was operational.
What information does the database contain?
The database contains the information referred to in Article 71(2) and (3): the data listed in Sections A and B of Annex VIII, entered by the provider or authorised representative, and the data listed in Section C of Annex VIII, entered by the deployer who is or acts on behalf of a public authority, agency or body. It also contains information about AI systems registered following an Article 6(3) conclusion that they are not high-risk, and information about testing in real world conditions registered under Article 60 and Annex IX. The scope is therefore defined by the Annexes, not by what a provider happens to consider informative. A team preparing an entry should work through the applicable Annex section item by item, confirm that each item is accurate for the system version concerned, and keep the supporting documentation that shows where each item came from. Adding marketing material or omitting a required item both weaken the entry.
For the broader regulatory framework, see EU database, registration and post-market monitoring.
How is public access organised?
Article 71(4) states that, with the exception of the section referred to in Article 49(4) and Article 60(4)(c), information contained in the database registered under Article 49 is accessible and publicly available in a user-friendly manner, and should be easily navigable and machine-readable. That public character is deliberate: it allows deployers, researchers, civil society and other interested readers to see which systems have been registered and on what basis, and it supports the supervision work of authorities. Public access does not mean unlimited disclosure. The information is the Annex VIII information, the database contains personal data only where necessary, and restricted sections remain restricted. A provider should therefore write an entry knowing it may be read publicly, use precise and neutral wording, and avoid including trade secrets, personal data or other material beyond what the Annex requires.
What stays restricted, and who can see it?
Two kinds of information stay restricted. First, registration for the defined law enforcement, migration, asylum and border control systems in Article 49(4) sits in a secure non-public section, and only the Commission and the national authorities referred to in Article 74(8) have access to those restricted sections. Second, information registered under Article 60 concerning testing in real world conditions is accessible only to market surveillance authorities and the Commission, unless the prospective provider or provider has given consent for it also to be made accessible to the public. High-risk systems in Annex III point 2 are registered at national level rather than in the EU database, which is a further access difference to record. A team must therefore identify its access category before submitting anything, because an assumption that an entry will be public, or that it will stay private, can be wrong in either direction.
What happens when the specification changes?
Because the Commission consults experts when setting the functional specifications and consults the Board when updating them, a database specification change should be treated as a review trigger for every registered entry and every internal template that feeds an entry. The practical response is to record the specification version used for each submission, to re-check the Annex items against the new specification, and to correct or supplement entries where the specification requires it. A change in specification does not by itself change the legal duties in Articles 49 and 71, but it can change the format, the required fields or the access presentation, and an entry that no longer matches the current specification can create confusion for an authority or a deployer relying on it. The dated source of truth for registration should therefore carry both the legal provision and the specification version, with the date each was last checked.
Continue with what is public and what is restricted in the EU database.
What does this guide not decide?
This guide does not decide what a particular system must enter, whether its entry is public or restricted, or how the live database submission process works on a given date. Those questions depend on the system's category, the operator role, the applicable Annex section and the current functional specification, and they require the consolidated text and current Commission material to be checked for the specific case. The guide also does not interpret the data protection rules that govern personal data in the database beyond the necessity limit stated in Article 71(5). Where an entry touches a sensitive use, a restricted section or a testing registration, confirm the access and content position with a competent authority or legal adviser before submitting.
Frequently asked questions
Who runs the EU database?
The Commission sets up and maintains it in collaboration with the Member States, consulting relevant experts on the functional specifications and the Board on updates to them.
Is EU database information machine-readable?
Article 71(4) states that Article 49 information, apart from the restricted sections, should be easily navigable and machine-readable, and publicly available in a user-friendly manner.
Can a provider consent to public access for testing information?
Yes. Information registered under Article 60 is restricted to market surveillance authorities and the Commission unless the prospective provider or provider has given consent for it also to be made accessible to the public.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689, as amended ↗AI Act Service Desk: Article 49 registration ↗AI Act Service Desk implementation timeline ↗